mirror of
https://github.com/django/django.git
synced 2025-03-16 12:20:46 +00:00
40 lines
1.6 KiB
Plaintext
40 lines
1.6 KiB
Plaintext
|
==========================
|
||
|
|
Django 1.4.4 release notes
|
||
|
|
==========================
|
||
|
|
|
||
|
|
*February 19, 2013*
|
||
|
|
|
||
|
|
This is the fourth bugfix/security release in the Django 1.4 series.
|
||
|
|
|
||
|
|
Host header poisoning
|
||
|
|
---------------------
|
||
|
|
|
||
|
|
Some parts of Django -- independent of end-user-written applications -- make
|
||
|
|
use of full URLs, including domain name, which are generated from the HTTP Host
|
||
|
|
header. Django's documentation has for some time contained notes advising users
|
||
|
|
on how to configure webservers to ensure that only valid Host headers can reach
|
||
|
|
the Django application. However, it has been reported to us that even with the
|
||
|
|
recommended webserver configurations there are still techniques available for
|
||
|
|
tricking many common webservers into supplying the application with an
|
||
|
|
incorrect and possibly malicious Host header.
|
||
|
|
|
||
|
|
For this reason, Django 1.4.4 adds a new setting, ``ALLOWED_HOSTS``, containing
|
||
|
|
an explicit list of valid host/domain names for this site. A request with a
|
||
|
|
Host header not matching an entry in this list will raise
|
||
|
|
``SuspiciousOperation`` if ``request.get_host()`` is called. For full details
|
||
|
|
see the documentation for the :setting:`ALLOWED_HOSTS` setting.
|
||
|
|
|
||
|
|
The default value for this setting in Django 1.4.4 is `['*']` (matching any
|
||
|
|
host), for backwards-compatibility, but we strongly encourage all sites to set
|
||
|
|
a more restrictive value.
|
||
|
|
|
||
|
|
This host validation is disabled when ``DEBUG`` is ``True`` or when running tests.
|
||
|
|
|
||
|
|
|
||
|
|
Other bugfixes and changes
|
||
|
|
==========================
|
||
|
|
|
||
|
|
* Changed a SQL command syntax to be MySQL 4 compatible (#19702).
|
||
|
|
* Added backwards-compatibility with old unsalted MD5 passwords (#18144).
|
||
|
|
* Numerous documentation improvements and fixes.
|